Having to pick a delimiter that won't occur in your data is bad. Instead, escape the data such any instance of you your delimiter is removed or distinguishable from an actual delimiter.

In this case, it's easy to remove commas by URI escaping the data before joining the fields.

At the client, (My syntax might be off)

list_items.value = list_items
                   .map(function (v) { return encodeURIComponent(v) })
                   .join(',');
[download]

At the server,

use URI::Escape qw( uri_unescape );

my @list_items = map { uri_unescape($_) }
                 split(/,/, $cgi->param('list_items'));
[download]

But javascript is not needed.

The following works for me, fully escaping all binary stuff in the value array, just using CGI (and URI::Escape for serialization as proposed by you)

#!perl
use strict;
use CGI;
use URI::Escape;
my $cgi = new CGI;
my $i = 0;
my @Values = map { uri_escape pack('c', $i++) } 1..10;
my %Labels = map {$_, "Label$_"} @Values;
my $size = @Values - 1;
my $attr = 'listbox';

my @rightParams = (
  -class=>'writeField',
  -name=>$attr,
  -values=>\@Values,
  -size=>$size,
  -multiple=>'true',
  -labels=>\%Labels,
);

my @selected = $cgi->param($attr);
my @all = $cgi->param('theValues');

print $cgi->header(),
  $cgi->start_html(-title=>$attr),
  $cgi->start_form(),
  $cgi->scrolling_list(@rightParams),
  $cgi->p('all (from hidden field): ', join(q(, ), @all)),
  $cgi->hidden(-name=>'theValues', -default=>\@Values),
  $cgi->p('you selected: ', join(q(, ), @selected)),
  $cgi->submit(),
  $cgi->end_form(),
  $cgi->end_html(),
  ;
[download]

Deserialize with uri_unescape as needed.

I think you missed this bit of the OP:

The values displayed in the list box are being changed dynamically via JavaScript.

Your code will return the initial contents of the list box, not the content changed by JavaScript as desired by the OP.

(By the way, why are you're using a hidden field and not the session to send data from the script to a future invocation of itself?)